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A data word is a sequence of pairs of a letter from a finite alphabet and an element from an 
infinite set, where the latter can only be compared for equality. To reason about data words, 
linear temporal logic is extended by the freeze quantifier, which stores the element at the current 
word position into a register, for equality comparisons deeper in the formula. By translations 
from the logic to alternating automata with registers and then to faulty counter automata whose 
counters may erroneously increase at any time, and from faulty and error-free counter automata 
to the logic, we obtain a complete complexity table for logical fragments defined by varying the 
set of temporal operators and the number of registers. In particular, the logic with future-time 
operators and 1 register is decidable but not primitive recursive over finite data words. Adding 
past-time operators or 1 more register, or switching to infinite data words, cause undccidability. 
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1. INTRODUCTION 

Context. Logics and automata for words and trees over finite alphabets are rel- 
atively well-understood. Motivated partly by the need for formal verification and 
synthesis of infinite-state systems, and the search for automated reasoning tech- 
niques for X]\/IL, there is an active and broad research programme on logics and 
automata for words and trees which have richer structure. 

Segoufin's recent survey [Segoufin 2006] summarises the substantial progress 
made on reasoning about data words and data trees. A data word is a word 
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over a finite alphabet, with an equivalence relation on word positions. Implicitly, 
every word position is labelled by an element ("datum") from an infinite set ("data 
domain"), but since the infinite set is equipped only with the equality predicate, it 
suffices to know which word positions are labelled by equal data, and that is what 
the equivalence relation represents. Similarly, a data tree is a tree (countable, un- 
rankcd and ordered) whose every node is labelled by a letter from a finite alphabet, 
with an equivalence relation on the set of its nodes. 

First-order logic for data words was considered in [Bojariczyk et al. 2006], where 
variables range over word positions ({0, . . . , ^ — 1} or N), there is a unary predicate 
for each letter from the finite alphabet, and there is a binary predicate x ^ y 
for the equivalence relation representing equality of data labels. F0^(~, <, +1) 
denotes such a logic with two variables and binary predicates x + I = y and x < y. 
Over finite and over infinite data words, satisfiability for F0^(~, <, +1) was proved 
decidable and at least as hard as reachability for Petri nets. The latter problem 
is ExpSPACE-hard [Lipton 1976], but whether it is elementary has been open for 
many years. If the logic is extended by one more variable, +1 becomes expressible 
using <, but satisfiability was shown undecidable. 

Words which contain data from domains with more than the equality predicate 
were proposed in [Bouajjani et al. 2007] as models of configurations of systems with 
unbounded control structures. Decidability of satisfiability was proved for the 3*V* 
fragment of a first-order logic over such words provided that the underlying logic 
on data is decidable. 

Alternatively to first-order logic over data words, expressiveness and algorithmic 
properties of formalisms based on linear temporal logic were studied in [French 
2003; Lisitsa and Potapov 2005; Demri et al. 2007; Lazic 2006; Demri et al. 2007; 
Demri et al. 2008]. LTL was extended by the freeze quantifier: Ir stores in register 
r the equivalence class of the current word position, and the atomic formula Ir in 
its scope is true at a word position iff the latter belongs to the equivalence class 
stored in r. Thus, data at different word positions can be compared for equality. 
Freeze quantification has also been considered in timed logics (cf. e.g. [Alur and 
Henzinger 1994]) and hybrid logics (cf. e.g. [Goranko 1996]), and Fitting has called 
for an investigation of effects of its addition to modal logics [Fitting 2002]. Let 
LTL^(0) denote LTL with the freeze quantifier, n registers, and temporal operators 
O. Satisfiablity over infinite data words was shown highly undecidable (i.e., Sj^- 
hard) for LTL^(X, X'^ F, F'^) in [French 2003] (where X^^ and F"^ are the past- 
time versions of X and F) and for LTL2(X,U) in [Lisitsa and Potapov 2005; Demri 
et al. 2007], so complexity (even decidability) of fragments with 1 register remained 
unknown. To obtain decidability, various structural restrictions were employed: flat 
formulae [Demri et al. 2007], Boolean combinations of safety formulae [Lazic 2006], 
and that the freeze quantifier is used only for expressing that the current datum 
occurs eventually in the future or past [Demri et al. 2007]. In [Demri et al. 2008], 
decidability was obtained by replacing satisfiability with model checking data words 
generated by deterministic one-counter automata. 

A third approach to reasoning about data words are register automata [Kaminski 
and Prancez 1994; Sakamoto and Ikeda 2000; Neven et al. 2004]. In addition to a 
finite number of control locations, such an automaton has a finite number of regis- 
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ters which can store data for later equahty comparisons. In pursuit of a satisfactory 
notion of regular languages of finite data words, nonemptiness was shown decidable 
for one-way nondctcrministic register automata, but the class turned out not to 
be closed under complement, and the nonuniversality problem to be undecidable. 
However, for such automata A and A', whether the language of A contains the 
language of A' was proved decidable provided A has only 1 register (in the termi- 
nology of this paper). The subclass with 1 register was thus the best candidate 
found for defining regularity, but it is also not closed under complement. The case 
of infinite data words was not considered. 

Contribution. The main technical achievement of the paper arc translations as 
depicted in Figure 1. Over finite and over infinite data words, the translation 
from the logic to register automata preserves languages, and for the translations to 
and from counter automata, appropriate projections of data words are taken. For 
infinite data words, the register automata have the weak acceptance mechanism 
[Muller et al. 1986], which makes them closed under complement. Alternation is 
needed because there exist properties which are expressible in LTLj(X,F) (e.g., 'no 
two word positions have equal data') but not by any one-way nondeterministic 
register automaton. The counter automata are one-way, nondeterministic, accept 
infinite words by the Biichi mechanism, and are faulty in the sense that counters 
may erroneously increase at any time. 

Using results in [Schnoebelen 2002; Mayr 2003; Ouaknine and Worrell 2006a; 
2006b], we show that nonemptiness for the faulty counter automata is decidable 
and not primitive recursive over finite words, and n^-complete over infinite words. 
Hence, the same bounds hold for LTLj(X,F) satisfiability, LTL|(X,U) satisfiability, 
and nonemptiness of one-way alternating automata with 1 register. The latter 
therefore provide an attractive notion of regular languages of finite data words, 
although the complexity of nonemptiness is very high. 

The incrementing errors of counter automata correspond to restricted powers of 
future-time LTL and one-way alternating automata with 1 register. As soon as any 
of 1 more register, the temporal operator or backward automaton moves are 
added, even after replacing U by F and restricting to universal automata, decidability 
and n^-membership break down: we obtain logarithmic-space translations from 
Minsky (i.e., error- free) counter automata, which result in Sj-hardness over finite 
data words and E}-hardness over infinite data words. Together with the bounds 
via the faulty counter automata, that gives us a complete complexity table for 
fragments of LTL with the freeze quantifier defined by varying the set of temporal 
operators and the number of registers (see Figure 12). 

Interestingly, similar results were reported in [Ouaknine and Worrell 2006a] for 
real-time metric temporal logic, by translations to and from alternating automata 
with 1 clock and machines with fifo channels. Indeed, computing a counter au- 
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tomaton with incrementing errors from a sentence of LTLj(X, U) follows the same 
broad steps as may be employed to compute a channel machine with insertion errors 
from a sentence of (future-time) MTL. some of which were implicit already in the 
proof that whether the language of a one-way nondeterministic register automa- 
ton is contained in the language of such an automaton with 1 register is decidable 
over finite data words [Kaminski and Francez 1994, Appendix A]. However, there 
is no obvious translation from LTLj(X,U) to MTL or alternating automata with 
1 clock, and counters are less powerful than fifo channels. Also, the translations 
from counter automata to LTL with freeze in this paper and those from channel 
machines to MTL differ substantially. 

The decidability of satisfiability for LTL\ (X, U) over finite data words makes it the 
competitor of F0^('^, <, +1). To clarify the relationship between the two logics, 
we extend the equiexpressiveness result in [Etessami et al. 2002] and show that 
F0^(~, <, +1, . . . , -l-m) is as expressive as LTL];(X, X~^,F, F~^) with a restriction 
on freeze quantification. However, temporal sentences may be exponentially longer 
than equivalent first-order formulae. 

Organisation. After setting up machinery in Section 2 and presenting the equiex- 
pressiveness result for F0^(~, <, . . . , +m) in Section 3, the core of the paper 
is Sections 4 and 5, which contain the results on complexity of satisfiability for 
fragments of LTL with the freeze quantifier and nonemptiness for classes of register 
automata. We conclude in Section 6. 

2. PRELIMINARIES 

After defining words with data, we introduce below logics and automata with which 
we shall work in the paper. To define acceptance by alternating automata, we recall 
a simple class of two-player games. This section also contains several results which 
will be used later. Their proofs are either relatively straightforward or heavily based 
on proofs in the literature. 

2.1 Data Words 

A data word a over a finite alphabet E is a nonempty word str (cr) over S together 
with an equivalence relation on its positions. We write \a\ for the length of the 
word, a(i) for the letter at position i, and [z]^<7 for the class that contains i, where 
< 2 < |(t|. When a is understood, we may write simply ~ instead of . We 
shall sometimes refer to classes of ^ as 'data'. 

Example 2.1. A data word of length 3 over {a,b} is a such that str(cr) = aab 
and the classes of are {0, 2} and {1}. 

2.2 LTL over Data Words 

Syntax. LTL-'-(O) will denote the linear temporal logic with the freeze quantifier 
and temporal operators in the set O. Each formula is over a finite alphabet S. 
Atomic propositions a are elements of S, D ranges over O, and r ranges over N>o. 

::= a I T I I (/.A<^ I O(</),...,0) | i,</. | Tr 

An occurence of tr within the scope of some freeze quantification Ir is bound by 
it; otherwise, it is free. A sentence is a formula with no free occurence of any t^.- 
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We consider temporal operators 'next' (X), 'eventually' (F), 'until' (U), and their 
past-time versions (X~^, F~^, U~^). As F(f) is equivalent to T\5(l>, F can be omitted 
from any set which contains U, and the same is true for F""'^ and U""'^. As usual, we 
regard G ('always') and ('past always') as abbreviations for -iF-^ and -^F"^-!. 

Let LTLJj(O) be the fragment with n registers, i.e. where r G {1, . . . , n}. 

Semantics. A register valuation v for a data word cr is a finite partial map from 
N>o to the classes in cr, i.e. to {i : < i < \<j\}/^- If r ^ dom{v), then the atomic 
formula will evaluate to false with respect to v. Such undefined register values 
will be used for initial automata states. We say that v is an n-register valuation iff 
dom(w) C {!,..., n}. 

For a data word a over a finite alphabet S, a position < i < \a\, a register 
valuation v for a, and a formula <p over S, writing a,i \=y (j) will mean that </> is 
satisfied by a at position i with respect to v. The satisfaction relation is defined as 
follows, where we omit the Boolean cases. 

(T{i) = a 

i + 1 < and a,i + 1 \=v (j) 
i — 1 >0 and a,i — 1 |=„ (j) 

for some j > i, a,j \=y tl) and for all i < j' < j, ct, j' ^„ (j) 
for some j < i, a,j \=y tjj and for all j < f < i, a,j' |=„ <p 
a,i \=vir<-^i{\^] 
r G dom(v) and i G t;(r) 

Example 2.2. Consider the sentence = G(a iiX((G(a -.ji)) A(F(6Ati)))) 

of LTLi(X,F), which is over the alphabet {a, b}. It states that no two letters a arc 
in the same class, and that every letter a is followed by a letter b which is in the 
same class. Thus, for the data word a in Example 2.1, we have a, (p. 

2.3 FO over Data Words 

As defined in [Bojanczyk et al. 2006], F0(~, <, +1, . . . , -|-m) denotes first-order 
logic over data words, in which variables range over word positions. We use variable 
names xq, Xi, ... The predicates Xi < xj and interpreted as 

expected. Each formula has an alphabet S, and it may contain unary predicates 
Pa{xi) which are satisfied by a data word iff the letter at position Xi is a. When 
we write 4>{xi^ , ■ ■ ■ , Xi^), it means that at most Xi^, . . . , occur free in </>. 
F0"(~, <, -|-1, . . . , +m) is the fragment with n variables xq, . . . , Xn-i- 

Example 2.3. Let (f)'{xo) be the following formula of F0^(~, <), which states 

that, from position xq onwards, no two letters a arc in the same class, and every 
letter a is followed by a letter b which is in the same class. 

Va;i(-.(3;i < xq) A Pa{xi) =^ 
Va;o(a;i <xoAPa{xo) => -'Xi ~ a;o) A 3a;o(a;i < xq A Pb{xo) A xi ~ xq)) 

It is equivalent to the sentence </> from Example 2.2 in the sense that, for every data 
word a over {a, b} and < i < |cr|, we have a,i |=0 ^ iff cr |=[j;oH^j] (f)'{xo). 
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2.4 Weak Games 

The automata that will be introduced in the next section will be alternating and 
weak [MuUer et al. 1986], so we shall use the following class of zero-sum two-player 
finitely branching games to define acceptance by such automata. 

Games. A weak game G is a tuple (P, Pi, P2, — >, p) such that: 

— P is a set of all positions; 

— Pi and P2 disjointly partition P into positions of players 1 and 2 (respectively); 

> C P X P is a successor relation with respect to which every position has 

finitely many successors; 
— p : P ^ N specifies ranks so that, whenever p — * p', we have p{p) > p{p'). 

A play TT of G is a sequence popi ... of positions of G such that Pi pi+i for 
each i. If tt is infinite, let p(7r) = p{pi), where i is such that p{pj) = p{pi) for all 
j > i (such an i necessarily exists) . 

We say that a play tt of G is complete ifi^ either it ends with a position without 
successors or it is infinite. For such tt, we consider it winning for player 1 iff either 
it ends with a position of player 2 or it is infinite and p(7r) is even. The winning 
condition for player 2 is symmetric, with the opposite parity. 

A strategy for player I from a position p of G is a tree r C P<'^ of finite plays of 
G such that: 

(i) p & T and it is the root; 

(ii) whenever tt G t ends with a position p of player I which has at least one 
successor, it has a unique child; 

(iii) whenever tt G r ends with a position p of the other player, it has all children 
7rp' with p ^ p' ■ 

We say that t is positional iff the choices of successors in (ii) depend only on the 
ending positions p. 

Now, a play by r is either an element of r or an infinite sequence whose every 
nonempty prefix is an element of r. We say that r is winning iff each complete play 

by T is winning for player I. 

Consistent Signature Assignments. Let G be a weak game as above. 

A consistent signature assignment for G is a function a from some C P to 

N such that the following are satisfied, where pairs of natural numbers are ordered 
lexicographically, i.e. (n, m) < (n', m') iff either n < n' , or n = n' and m < m' . 

— for every p G W C\ P\, there exists p ^ p' with p' £ W and {p{p'),a{p')) < 

{p{p),a{p)), where the inequality is strict if p{p) is odd; 
— for every p G W Ci P2 and every p p' , we have p' e W and {p{p'),a{p')) < 

{p{p),a{p)), where the inequality is strict if p{p) is odd. 

Part (a) of the result below is straightforward, whereas part (b) is obtained by 
simplifying the proof of [Walukiewicz 2001, Lemma 10] which is for more general 
parity games. 

Theorem 2.4. Suppose G is a weak game. 

ACM Transactions on Computational Logic, Vol. V, No. N, M 20YY. 



LTL with the Freeze Quantifier and Register Automata • 7 

(a) For every consistent signature assignment a for G and every p G doin(a), 
player 1 has a positional winning strategy from p. 

(b) There exists a consistent signature assignment a for G such that for every 
p ^ dom(a), player 2 has a positional winning strategy from p. 

The following are two immediate corollaries: 

— positional determinacy, i.e. that for every position p, one of the players has a 
positional winning strategy from p; 

— for every position p, there exists a consistent signature assignment which is de- 
fined for p iff player 1 has a positional winning strategy from p. 

2.5 Register Automata 

Corresponding to the addition of the freeze quantifier to LTL, finite automata can 
be extended by registers. We now define two-way alternating register automata 
over data words. 

A state of such an automaton for a data word will consist of a word position, an 
automaton location and a register valuation. From it, according to the transition 
function, one of the following is performed: 

— branching to another location depending on one of the following Boolean tests: 

whether the current letter equals a specified letter, whether the word position is 
the first or last, or whether the current datum equals the datum in a specified 
register; 

— storing the current datum into a register; 

— conjunctive or disjunctive branching to a pair of locations; 

— acceptance or rejection; 

— moving to the next or previous word position. 

The automata will be weak in that each location will have a rank, which will not 

increase after any transition, and whose parities will be used to define acceptance. 

Each location will also have a height, which will decrease after every transition 
which is not a move to another word position. The heights ensure that infinite 
progress cannot be made while remaining at the same word position. That con- 
straint simplifies some proofs without reducing expressiveness. 

Remark 2.5. In contrast to the formalisations of register automata in [Kaminski 
and Prancez 1994; Sakamoto and Ikeda 2000; Neven et al. 2004], data stored in 
registers within an automaton state will not be required to be mutually distinct 
and to contain the datum from the previously visited word position.^ 



'^That is a minor technical difference. It can be checked that, for every automaton with n + 1 
registers in the sense of [Kaminslci and Francez 1994; Sakamoto and Ikeda 2000; Ncvcn et al. 2004], 
one can construct an equivalent automaton with n + 1 registers and an equivalent alternating 
automaton with n registers in the sense of this paper. 
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Automata. The set A(S, Q, n) of all transition formulae over a finite alphabet E, 
over a finite set Q of locations and with n e N registers is defined below. 

B(E, n) = {a, beg, end, 1r- a £T,,r G {1, . . . ,n}} 
A(S,Q,n) = {qi(3:ifq',irq,qAq',qVq',T,±,Xq,Xq,X-^q,I=^q : 
l3eB{E,n),q,q' eQ,rG{l,...,n}} 

We have that A{T,,Q,n) is closed under the self- inverse operation of taking duals: 

VWJZ = 9 ^ ^ 9' 9^ = 9 V g' ^ = Xg_ 
ir? = irq T = ± X-ig = X-ig 

The difference between transition formulae Xq and their duals Xq is that the former 
will be rejecting and the latter accepting if there is no next word position, and 
similarly for X~^g and X~^q. 

A register automaton ^ is a tuple (S, Q, qj, n, 6, p, 7) as follows: 

— E is a finite alphabet; 

— Q is a finite set of locations; 

— qi £ Q is the initial location; 

— n e N is the number of registers; 

— S : Q — > A(E, Q, n) is a transition function; 

— p : Q N specifies ranks and is such that, whenever q' occurs in 5{q), we have 

pW) < piq); 

— 7 : ^ N specifies heights and is such that, whenever S{q) is of the form 
9' ^ ^ Q", irl', q' a q" or q' V q", we have 7(9')>7(3") < 7(9)- 

We say that a register automaton is: 

one-way iff no S{q) is of the form q' <j; beg :j> q" , X~^q' or X~^q'; 

nondeterministic iff no 6{q) is of the form q' A q"; 

universal iff no 6{q) is of the form q' V q"; 

deterministic iff it is both nondeterministic and universal. 

For d e {1,2} and C G {A.N, U.D}, let dCRA denote the class of all register 
automata with restrictions on directionality and control specified by d and C. Let 
dCRAn denote the subclass with n registers. 

Acceptance Games. Let Ahea. register automaton as above, and tr be a data word 
over E. The acceptance game of A over a is the weak game Gj\^,a = {P- Pi . P2 , p) 
defined below. Player 1 ("automaton") will be resolving the disjunctive branchings 
given by the transition function of A, winning a finite play if it ends with an 
accepting state, and winning an infinite play if the limit location rank is even. 
Dually, player 2 ("pathfinder") will be resolving the conjunctive branchings and 
winning at rejecting states or by odd limit ranks. 

— P is the set of all states of A for a, which are triples {i, q, v) where < i < \a\, 
q & Q, and v is an n-register valuation for a. 
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1, if i = 


{(i-l,q',v)}, iii>0 0, if i = 



a, i \=v beg i = a,i \=v end i + 1 = |<t| 



Fig. 2. Defining acceptance games 

— The partition of P into Pi and P2. and tin' successor relation, are given by the 
table in Figure 2. The ownership of states with unique successors has not been 
specified because it is irrelevant. The table omits dual transition formulae, which 
are treated by swapping the ownerships. 

—For every {i,q,v) G P, p{{i,q,v)) = p{q). 

Observe that every branching in G^^^ is at most binary. 

A run of A over a is a strategy r in G^,<7 for player 1 from the initial state 
(0,^7,0). We say that r is accepting iff it is winning, and that A accepts cr iff ^ 
has an accepting run over a. 

Example 2.6. Let ^ bo a register automaton with alphabet {a, b} and 1 register, 
whose locations and transition function are shown in Figure 3, and such that the 
ranks of qi and qj are even but the rank of qu is odd. It is straightforward to 
assign exact ranks and heights to the locations of A so that the conditions in the 
definition of register automata are satisfied. 

We have that A is one-way, neither nondeterministic nor universal, and equivalent 
to the sentence (f) from Example 2.2 in the sense that, for every data word a over 
{a, b}, A accepts ct iff cr, |=0 (j). 

In particular, A rejects the data word a from Example 2.1. By positional de- 
terminacy (cf. Theorem 2.4) of the acceptance game Gj^^a, player 2 ("pathfinder") 
has a positional winning strategy from the initial state (0, gi, 0). Such a strategy is 
shown in Figure 4, where — and {1} abbreviate register valuations and [1 1— > {1}] 
(respectively), sharp and oval frames indicate states belonging to players 1 and 2 
(respectively), and states whose owner is irrelevant are not framed. The strategy is 
positional trivially, as no state is visited more than once. Essentially, the pathfinder 
challenges the automaton to find a letter b which follows the second letter a and is 
in the same class. 

Closure Properties. We now consider closure of classes of register automata under 
complement, intersection and union. 

Theorem 2.7. (a) For each d € {1,2}, dARAn and dDRAn are closed under 
complement, and dNRAn is dual to dURA^. 

(b) For each G G {A, N, U, D}, IGRA is closed under intersection and union. For 
intersections of universal or alternating automata, and for unions of nondeter- 
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Fig. 3. A register automaton 
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Fig. 4. A positional winning strategy 

ministic or alternating automata, the maximum of the two numbers of registers 
suffices. Otherwise, their sum suffices, 
(c) 2URA is closed under intersection, 2NRA is closed under union, and 2ARA 
is closed under intersection and union. The maximum of the two numbers of 
registers suffices. 

In each case, a required automaton is computable in logarithmic space. 

Proof. For a register automaton A as above, its dual A = {T,,Q,qi,n,5,p,^) 
is defined by S{q) = d{q) and p{q) = p{q) + 1 for each q € Q. 

It sufSces for (a) to show that, for every data word a over S, A accepts a iff ^ 
rejects a. The latter is immediate by determinacy of weak games (cf. Theorem 2.4), 
and by observing that r is a winning strategy in G_a.(t for player 1 from (O,g/,0) 
iff T is a winning strategy in ^ for player 2 from (0, g/, 0). 

The nontrivial parts of (b) and (c) are the closures of INRA under intersection, 
lURA under union, and IDRA under intersection and union. By (a), we shall be 
done if, given Ai = (S, Qi, g), m, (5i, pi, 71) and A2 = (S, (^2, gf , n2, i52, P2, 72) in 
INRA, we show how to compute in logarithmic space A = (S, Q, g/, ni + n2, S, p, 7) 
in INRA which accepts a data word a over E iff both Ai and A2 do, and such that 
A is in IDRA if both Ai and A2 are. 

As in the proof of [Kaminski and Prancez 1994, Theorem 3], .A is obtained by 
a product construction, so we only provide it. The locations of A are pairs of 
locations of ^1 and A2, i.e. Q = Qi x Q2, and the initial location qj is {q],q^). 
Transitions of A will be of one of the following three kinds: 
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X(9i,92> 


X(9i,92) 



Fig. 5. Defining 5((9i,92)) from ^1(91) (rows) and ^2(92) (columns) 

— a transition of one of Ai or A2 which does not change the word position; 

— a transition of one of ^1 or A2 which moves to the next word position, provided 

the other automaton has accepted; 
— a pair of transitions of Ai and A2 which both move to the next word position. 

For the former two kinds, we define ((^1,92) for a transition formula of A\ 
and a location 92 of A2 to be the transition formula of A obtained by pairing 
with q2 ca(;h location which occurs in tpi. Transition formulae {qi,(f2) arc defined 
similarly, where also occurences of registers r2 in (p2 are replaced by ni + r2, so 

c-g- {qi,q2 i Tr2 ^ 92> = {11,12) i- Tru+r2 ^ (<?i,g2>- For each (171,92) G Q, its 
transition formula is then defined in Figure 5, where the choice in the upper left- 
hand corner of {Si{qi),q2) instead of {qi,S2{q2)) is arbitrary. The ranks are given 
by p{{qi,q2)) = {p{qi) + l) x (^(^2) + l) + 1, which is even iS p{qi) and p{q2) are 
both even, and the heights by 7((q'i, 92)) = 7(?i) + 7(92)- □ 

2.6 Counter Automata 

We define below two kinds of automata with counters, namely without errors and 
with incrementing errors, and then consider the complexity of deciding their non- 
emptiness, over finite and over infinite words. 

AutomMta. A counter automaton (CA) C, with e transitions and zero testing, is 
a tuple of the form (E, Q, qi, n, 6, F), where: 

— S is a finite alphabet; 

— Q is a finite set of locations; 

— Qi is the initial location; 

— n G N is the number of counters; 

— S C Q X (S W {e}) X L X Q is a transition relation over the instruction set 
L = {inc, dec, if z} x {1, . . . , n}; 

— F C Q is the set of accepting locations, such that q' ^ F whenever {q, e, I, q') G 5. 

A state of C is a pair {q, v) consisting of a location q G Q and a counter valuation 
v: {l,...,n} ^N. 

If C is Minsky (i.e. without errors), its transitions are of the form {q,v) 
{q',v'), which means that {q,w,l,q') G 6 and v' is obtained from v by performing 
instruction I in the standard manner, where I = (dec,c) requires v{c) > and 
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a, inc, 1 



Fig. 6. A counter automaton 
over finite words 




b, if z, 1 b, ifnz, 1 

I = (if z, c) requires v{c) = 0. A run of C is then a nonempty sequence of transitions 

{qo,vo) (^i: ^^i) "^^^ ■ ■ ■ where the initial state is given by qo = qi and wo(c) — 
for each c. We consider a finite run accepting iff it ends with an accepting location, 
and an infinite run accepting iff accepting locations occur infinitely often. We say 
that C accepts a word w' over S iff there exists a run as above which is accepting 
and such that w' = wqWi ■ • •• 

The other case we consider is when C is incrementing, i.e. its counters may 
erroneously increase at any time. For counter valuations v and wf, we write v < w-f 
iff v{c) < v-\{c) for each c. Runs and acceptance of incrementing C are defined in 

the same way as above, but using transitions of the form (g, v) ^^-f (g', v'), which 

means that there exist Vf and v'^ such that v < Vf, {q,Vf) {q\v'^) and v'^ < v'. 
When it is clear that we are considering an incrementing CA, we may write simply 

— > instead of — 

Example 2.8. Let C^'^ be the 1-counter automaton with alphabet {a,b} that is 
shown in Figure 6, and the 2-counter automaton with the same alphabet that is 
given by Figure 7, where ifnz is used as syntactic sugar for a decrement succeeded 
by an e increment. Since we shall consider acceptance of only finite words by C^'^ 
and acceptance of only infinite words by C^, their accepting locations are indicated 
in corresponding styles. 

We have that C^'^ (resp., C^) accepts a finite (resp.. infinite) word w iff every 
occurence of a is followed by a separate occurence of h, which is iff there exists a 
data word <t such that str((T) = w and which satisfies the LTL{ (X, F) sentence (p from 
Example 2.2. That is the case regardless of whether the automata are regarded as 
Minsky or incrementing. 

Counter automata and were obtained from a register automaton A as in 
Example 2.6, using the proof of Theorem 4.4 below. 

Complexity of Nonemptiness. It turns out that CA with incrementing errors are 
easier to analyse than CA without errors. 

Theorem 2.9. (a) For Minsky CA, nonemptiness is T}l-com/plete over finite 
words, and T,\-com,plete over infinite words, 
(b) For incrementing CA, nonemptiness is decidable and not primitive recursive 
over finite words, and Il\-complete over infinite words. 

Proof. For the finitary part of (a), we refer the reader to [Minsky 1967], and 
for the infinitary part, e.g. to [Alur and Henzinger 1994, Lemma 8]. Note that the 
lower bounds hold already with singleton alphabets, no e transitions and 2 counters. 
Over finite words, those restrictions can be tightened by adding determinism, so 
that for each location, either there is one outgoing transition and it is an increment, 
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Fig. 7. A counter automaton over infinite words 

or there are two outgoing transitions and they are a deerement and a zero test of 
the same counter. 

To obtain the finitary part of (b), we observe that by reversing transition rela- 
tions, there are logarithmic-space reductions between nonemptiness for increment- 
ing CA over finite words and reachability for classic lossy counter machines [Mayr 
2003]. The latter problem is indeed decidable [Mayr 2003, Theorem 6] and not 
primitive recursive [Schnoebelen 2002]. 

Incrementing CA can be seen as insertion channel machines with emptiness test- 
ing (ICMETs) [Ouaknine and Worrell 2006a] whose message sets are singletons, 
so Ilj'-membership of nonemptiness for incrementing CA over infinite words is a 
corollary of n"-membership of the recurrent-state problem for ICMETs [Ouaknine 
and Worrell 2006b]. It can also be shown directly by considering the following 
procedure. Given an incrementing CA C, compute a tree of all states which are 
reachable from the initial state. Allowing only incrementing errors which are decre- 
ments which do not alter the counter value makes the tree finitely branching. Along 
every branch, stop as soon as a state (g, v) is reached such that either q is accept- 
ing or some previous state on the branch is of the form {q, v') with v' < v. By 
Dickson's Lemma [Dickson 1913], each branch is finite, so by Konig's Lemma, the 
computation terminates. The above is then repeated from each leaf whose location 
is accepting. It remains to observe that the procedure terminates iff C does not 
have an accepting infinite run. 

That nonemptiness for incrementing CA over infinite words is Il^-hard is ob- 
tained by verifying that the proof of Ilj'-hardness of the recurrent-state problem for 
ICMETs [Ouaknine and Worrell 2006a, Theorem 2] can be adapted to the more re- 
strictive setting of incrementing CA. We reduce from emptiness over finite words for 
deterministic Minsky CA with singleton alphabets, no e transitions and 2 counters. 
Given such an automaton C, an incrementing CA C with 5 counters Ci, C2, C", D 
and D' , which performs the pseudo-code in Figure 8, and whose unique accepting 
location corresponds to the end of the repeat loop, is computable in logarithmic 
space. In the simulations of C by C, counter D' prescribes how much "space" is 
allowed for the two counters and the number of steps of C. As in the proof of 
[Ouaknine and Worrell 2006a, Theorem 2], we have that C has an infinite accepting 
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repeat 

{ D' := D; 
while D' > 

{ simulate C using Ci and C2 as follows: 

- if C accepts, C stops 

Fig. 8. Pseudo-code for C ' '"''i^'isver Ci or C2 is decremented, increment D' 

- whenever Ci or C2 is incremented, decrement D' 

- after each step of C, increment C" and decrement D' 

- if D' = 0, exit the simulation; 

D' = D' + C1+C2 + C' - 1; Ci,C2,C' := }; 
D:=D + l} 

run iff the unique infinite run of C does not contain an accepting location. □ 
2.7 Languages, Satisfiability and Nonemptiness 

For a sentence ({) of LTL^(X,X-\U,U~i) or F0(--, <, +1, . . . , +m) with alphabet 
S, let L<'^(0) (resp., (</>)) denote the language of all finite (resp., infinite) data 
words over S which satisfy (p. We say that cp is satisfiable over finite or infinite data 
words iff the corresponding language is nonempty. 

Languages and nonemptiness of register automata and counter automata are 
defined analogously. 

3. LTL WITH 1 REGISTER VERSUS FO WITH 2 VARIABLES 

It was proved in [Etessami et al. 2002] that FO with 2 variables and predicates < 
and +1 is as expressive as unary LTL (i.e., with operators X, X~^, F and F"-'^), but 
that in the worst case, the latter is exponentially less succinct. We now establish 
a similar equiexpressivness result for F0^(~, <, +1, . . . , +m). First, we define the 
corresponding fragment of LTL-'^(X,X~^,F,F~^), which has 1 register and in which 
scopes of the freeze quantifier are carefully restricted. 

Suppose m gN. Let Om denote the following set of temporal operators: 

{X, X-\ . . . , X"", X""*, X'^+If, x-^'^+i^F-i} 

where X*^ (resp., X"*^) stands for k repetitions of X (resp., X^^). We say that 
a formula of LTL |^ (Cm) is simple iff each occurrence of a temporal operator is 
immediately preceded by |i (and there are no other occurences of J,i). 

A sentence 4> of LTL^ (X, X~^ , U, U~^) is said to be equivalent to a formula (j)'{x) of 
F0('~, <, +1, . . . , +m) iff they have the same alphabet S and, for every data word 
<T over S and < i < lcr|, we have a, i |=0 <^ cr ^[3,^^^] 0'(a;). 

Example 3.1. It is straightforward to rewrite the sentence (p from Example 2.2 
so that it belongs to simple LTL|(Oo)- Alternatively, that (p is equivalent to a 
sentence of simple LTL|(Oo) is a consequence of the following theorem, since it was 
observed in Example 2.3 that (p is equivalent to the formula <p'{xo) of F0^(~, <). 

Theorem 3.2. (a) For each sentence of simple LTL{{Om), an equivalent for- 
mula of i^0^(~, <, +1, . . . , +m) is computable in logarithmic space, 
(b) For each formula (p{xj) of FCP{'^, <, +1, . . . , +m), an equivalent sentence of 
simple LTL\{Om) is computable in polynomial space. 
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Proof. The following notations will be convenient. Let 0° =|i, 0*^ = J.iX'' for 
k G {-m,...,-l,l,...,m}, 0™+! = iiX^+ip, ^^^^ Q-{m+i) ^ ^_^yr-{m+i)p-i _ -poi 
j e {0, 1}, let 

j def 

xi = xi^j = Xj + k (1 < k < m) 
X-k = — + k {1 < k <m) 

Xm+l = Xj < Xi-j A Al<fe<r„ -^Xi-j =Xj+k 
X-(m+l) ~ < ^ Al<fc<m ~'Xj = Xl-j + k 

(The equality predicate can be expressed using <.) 

We have (a) by the following translations Tj which map simple LTL{(Om) for- 
mulae to F0^(^, <, +1, . . . , +m) formulae. Each sentence (p will be equivalent to 
Tj{(j)) which will contain at most xj free. The maps Tj are defined by structural 
recursion, by encoding the semantics of simple formulae into first-order logic, and 
by recycling variables (to use only two variables). The Boolean clauses are omitted. 

For (b), we proceed by adapting the proof of [Etessami et al. 2002, Theorem 1]. 
We define recursively translations Tj from F0^(~, <, +1, . . . , +m) formulae ^{xj) 
to equivalent simple LTL|(C'„j) sentences. The cases of Boolean operators and one- 
variable atomic formulae are straightforward. The remaining case is when (^{xj) is 
of the form 

3xi-j P{ai{xo, xi), aLixo, xi), ^i{xj), ^wixj), Ci(a;i-j), • • • , CM(a;i-j)) 

where /3 is a Boolean formula, and each ai{xo,xi) is a < or +k atomic formula. 

Now, for each —(to + 1) < k < rn + 1 and b £ {T,_L}, let al'^ denote the truth 
value of ai{xo^xi) under assumptions Xk ^^'^ ~ Xi-j <^=> b. Also, for each 
X C {1, . . . , AT}, let = T if i G X, and 4^ = ± otherwise. T^{(j){xj)) is then 
computed as 

V-(m+l)<fc<m+l Vbe{T _L} VxC{l,...,Ar} { Aie{l Nj'^ji^iiXj)) ^(.f)^ 

0'=((Ti ^ 6) A /3(a^^ . . . ,ar,^f , . . . ,^^,T{_^.(Ci(xi_,)), . . . ,TI_^{Cm{x^-j))) 

The size of the equivalent simple LTL|(C'„i) formula is exponential in |0|, because 
the length of the stack of recursive calls is linear and the generalised conjunctions 
and disjunctions have at most exponentially many arguments. For the same reasons, 
polynomial space is sufficient for the computation. □ 

It was shown in [Bojahczyk et al. 2006] that, over finite data words, satisfiabil- 
ity for F0^(~,<,+1) is reducible in doubly exponential time to reachability for 
Petri nets, and that there is a polynomial-time reduction in the reverse direction. 
Reachability for Petri nets is known to be decidable (cf. e.g. [Kosaraju 1982]) and 
ExpSPACE-hard [Lipton 1976]. Two extensions of the decidability of satisfiability 
for F0^(^,<,+1) over finite data words were also obtained in [Bojahczyk et al. 
2006]: for F0^(~, <, +1, . . . , +m), and over infinite data words. By the following 
corollary of Theorem 3.2, those results have immediate consequences for complexity 
of satisfiability problems for simple fragments of LTL]; (£)„). 
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Corollary 3.3. Over finite and over infinite data words, satisfiability for the 
simple fragment of LTL\{Om) is reducible in logarithmic space to satisfiability for 
F0^(^, <, +1, . . . , +m), and there is a polynomial-space reduction in the reverse 
direction. 

4. UPPER COMPLEXITY BOUNDS 

A number of upper bounds on complexity of satisfiability for fragments of LTL 
with the freeze quantifier and complexity of nonemptiness for classes of register 
automata will be obtained below. The former will be corollaries of the latter, 
by the following result which shows that logical sentences are easily translatable 
to equivalent automata. Note that, in contrast to classical automata, alternating 
register automata are more expressive than nondeterministic and universal, and 
two-way register automata are more expressive than one-way [Kaminski and Francez 
1994; Neven et al. 2004]. As a specific example, the "nonces property" that no two 
word positions are in the same class is expressible in LTL];(X,F) (cf. Example 2.2) 
and by an automaton in lARAi, but not by any automaton in INRA. 

Theorem 4.1. For each sentence cf) of LTL^{X,l.~^,'\J,l!~^), an automaton A,j, 
in 2ARAn with the same alphabet and such that L<'^((/)) = 'L'^'^^A^) and L'^(0) = 
'L'^{A^) is computable in logarithmic space. If cf) is in LTLl^{L,\5), A^ is in lARAn. 

Proof. The translation is a simple extension of the classical one from LTL to 
alternating automata (cf. e.g. [Vardi 1996]). 

We can assume that <p is in negation normal form, where we write a, _L, V, and 
for the duals of a, T, A, e {X,X-\U,U-^} and Tr- 

Let cl((^) be the set of all subformulae of (j), together with T, ±, and all sub- 
formulae of ^ A X(V'Ux), A X-^{ip\J-^x), V X(V'Ux) or V V T^{ip\F^x) for each 
subformula of of the form tjj\5x, VU~^X) V'Ux or ip\5~^x (respectively). 

To define A,p = (S, Q, qj, n, (5, p, 7), let Q = {q^ : ip G c\{(t))} and qi = q^. 
The transition function is given below, where we omit dual cases: 



The ranks arc defined so that every (j^ux' has odd rank and every 'j'^ux' has 
even rank. For example, p{q,p) = 2\%l)\ unless if} is of the form x^x' 1 i^i which case 
p{q^) = 2|V| + 1. 

The heights may be defined as jiq-^,) = \tp\ unless tp is of the form x^x\ X^~^x' ^ 

XUx' or xU"^x', in which case 7(axUx') = Ix' V (x A X(xUx'))l etc. 

It remains to show the equalities between the languages of (f) and A^, so suppose 
(T is a data word over E. By a straightforward induction on ijj G cl(0), it holds 
that, for every < i < |c7| and n-register valuation v for a, we have a,i \=y tp iff 
player 1 has a winning strategy from state {i,q^,v) in game G.A^,cr- In particular, 
a,0 \=0 ^ iff A^ accepts a. □ 

The following basic upper bounds should be compared with the lower bounds in 
Theorem 5.4. 



^(9x1/;) = ^(O'V'Ux) = 9x V g'^Ax(V'Ux) 

^(^x-iv) = ^~^Qil> ^(^Vu-^x) = 9x V g'^/\x-i(v;u-ix) 
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Theorem 4.2. Over finite data words, satisfiability for LTL^{X,X~^,'U,IS~^) and 
nonemptiness for 2ARA are in Y,\. Over infinite data words, satisfiability for 
LTL^{X, X"\ U, U~^) and nonemptiness for 2ARA are in Sj, and nonemptiness for 

2NRA is in E^. 

Proof. By Theorem 4.1, it suffices to consider the register automata nonemp- 
tiness problems. 

That nonemptiness for 2ARA is in over finite data words and in over 
infinite data words arc straightforward consequences of Theorem 2.4. 

Suppose A is in 2NRA. Because of nondcterminism, A accepts a data word iff 
there exists a complete play from the initial state in the acceptance game which is 
winning for player 1. By Konig's Lemma, we have that A accepts an infinite data 
word iff there exists j & N such that for each k gN: 

(*) there exist a data word a of length k + 1 and a play tt = poPi ... of length at 
most k from the initial state in G^^a such that either tt is winning for player 
1, or TT is of length k and p{pj' ) is even for all j' > j. 

The S2-membership follows by observing that (*) is decidable. □ 

It was shown in [Sakamoto and Ikeda 2000] that nonemptiness for one-way nonde- 

terministic register automata over finite data words is in NP, and that the problem 
is NP-hard already for deterministic automata. However, due to the technical dif- 
ferences noted in Remark 2.5, the complexity for the notion of register automata 
in this paper turns out to be PSPACE-complcte, over infinite data words as well. 
The proof below of the PSPACE-memberships will also prepare us for establishing 
Theorem 4.4. The hardness results are in Theorem 5.1. 

We remark that, for infinite data words, it is straightforward to extend Theo- 
rems 4.3 and 4.4 to register automata with Biichi acceptance, without affecting the 
complexity bounds. 

Theorem 4.3. The following hold over finite and over infinite data words: 

— nonemptiness for INRA is in P Space; 

— for every fixed n gN, nonemptiness for INRAn is in NLogSpace. 
Proof. Suppose A = (S, Q, qj, n. S, p, 7) is in INRA. 

Let Hj^ be the set of all "abstract states" of the form (a, ee, R, q, E) where a G S, 
ee € {T, ±}, R is either or a class oi E, q G Q and E is an equivalence relation 
on a subset of {1, ... ,n}. For a data word <t (over E), let Q;^,ct be the following 
mapping from states of A (for a) to elements of H^: 

aA,a{{i, q, v)) = {a{i),i + l=\a\,{r : v{r) = [i]^}, q, 
{(r, r') : r,r' G dom{v) and v{r) = v{r')}) 

We define a relation on Hj, hy h ^ h' iff there exist a data word a and states 
p and p' of A such that aj\^„{p) = h, a_A.,aip') = h' and p — > p'. We say that 
h e H_/^ is initial (resp., winning) iff for some (equivalently, for every) data word 
a and state p of A such that aA,a{p) = h, we have that p is initial (resp., has no 
successors and belongs to player 2). 

Because of nondeterminism, A accepts a data word a iff there exists a complete 
play from the initial state in G^^^ which is winning for player 1. Since A is one-way, 
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for every sequence ho ^ hi ^ ■ ■ ■ in with /iq initial, there exist a data word a 
and a play popi . . . from the initial state in G^,o- such that ^^^^(pj) = hj for all j. 
Consequently: 

— L<"(^) is nonempty iff there exists a sequence /lo /ii —>■••• /ife in Hj, such 

that ft-o is initial and hk is winning; 
— {A) is nonempty iff: 

— either there exists a sequence h^ ^ hi ^ ■ • ■ hk va Hj^ such that /iq is initial, 

/ifc is winning, and the second component of h^ is _L, 
— or there exists a sequence ho ^ hi ^ ■ ■ ■ hk ^ hk+i ■ ■ ■ hk' in such that 
ho is initial, /ife = hk' , and the rank of the location in hk and hk' is even. 

It remains to observe that, for storing an abstract state and for checking the 

successor relation and the initial and winning properties on abstract states, space 
which is logarithmic in |S| and \Q\ and polynomial in n suffices. □ 

In terms of the definitions in this paper, it was established in [Kaminski and 
Prancez 1994, Appendix A] that containment of the language of an automaton in 
INRA in the language of an automaton in INRAi is decidable over finite data 
words. In particular, nonemptiness for lURAi (see Theorem 2.7) over finite data 
words is decidable. We now prove the main result of this section, which shows that 
decidability in fact holds for lARAi, and therefore also for LTLJ;(X,U) satisfiability. 
The two problems over infinite data words are shown to be co-r.e. The proof 
is by reductions to nonemptiness of incrementing counter automata, which will 
provide the first half of a correspondence between languages of incrementing CA 
and sentences of future-time fragments of LTL with 1 register (see Corollary 5.3). 

Using the developments in the proof of Theorem 4.3, it is straightforward to ex- 
tend the argument below to obtain the same upper bounds for containment of the 
language of an automaton in INRA in the language of an automaton in lARAi, 
or in the language of a sentence in LTLj(X,U). Over infinite data words, extend- 
ing further to one-way nondeterministic register automata with Biichi acceptance 
requires no extra work. 

Theorem 5.4 will show that decidability and n°-membership break down as soon 
as any of 1 more register, past-time operators or backward moves are added. 

Theorem 4.4. Satisfiability for LTL{{X,'[!) and nonemptiness for lARAi are 
decidable over finite data words, and in Hi over infinite data words. 

Proof. By Theorems 4.1 and 2.9 (b), it suffices to show that, given A in lARAi, 
incrementing CA C^'^ and C^'^ are computable such that 

L<^(C^'") = {str(a) : a G L<'^{A)} L'"(C^) = {str(a) : a G L'^(^)} 

In both cases, the proof will consist of the following steps: 

— replace the two-player acceptance games for A by one-player games whose posi- 
tions are built from sets of states of A {A cannot in general be translated to an 
automaton in INRA: see the remarks which precede Theorem 4.1), and whose 
successors are "big step" in the sense that they correspond to following strategies 
for the automaton until first moves to the next word position; 
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— combine the one-player acceptance games with searching for a data word to be 
accepted, resulting in a one-player nonemptiness game for A; 

— show how to construct a CA which guesses and checks a winning play in the 
nonemptiness game; 

— show that allowing incrementing errors in computations of the CA does not in- 
crease its language (such errors in an accepting computation will amount to intro- 
ducing superfluous states of A from which winning strategies for the automaton 
are then found). 

First, we consider computing C^". Let A = (S, Q, qj, 1, 6, p, 7). 

To define a big-step successor relation between sets of states, for a state p and a 
set of states P' of A for a data word a over S, let us write p => P' iS there exists 
a strategy r for player 1 from p in game G^,o- such that: 

— each complete play it G t which contains no move to another word position is 

winning for player 1; 
— P' is the set of all targets of first moves to another word position in plays of r. 

For sets of states P 7^ and P', we write P =^ P' iff there exists a map p P^ on 
P such that p ^ Pp for each p £ P and P' = UpeP ^p- Since A is one-way, if the 
first component of every state in P is i and P => P', then the first component of 
every state in P' is i -h 1. We call a set of states unipositional iff its members have 
the same first components. 

By positional dcterminacy of weak games (sec Theorem 2.4), the decreasing 
heights discipline of register automata, and Konig's Lemma, we have: 

(I) for every finite data word a over S, A accepts a iff there exists a sequence Pi, 
. . . , Pk-i of sets of states of A for a such that {(0, qi, 0)} => Pi => ■ • • Pk-i => 0. 

Now, let consist of and all "abstract sets" of the form (a, ee, Q=, Qg, |i) 
where a G S, ee G {T, _L}, Q=, Q^CQJ: V{Q) \ {0} -> N, and cither Q= 7^ or 
7^ or tt(Qf ) > for some Q-f. We define a mapping a^,^ from unipositional sets 
of states of A for a to elements of Hj( as follows: aj\^^„{%) = 0, and for nonempty 
P whose members' first component is i, 

aAAP) = HO. * + 1 = kl, {g : {i, q, [1 ^ [lU) G P}, {q : (z, q, 0) G P}, 
Qt ^ \{D + [z]. : {q ■ {i, q, [1 ^ D]) G P} = Qtll) 

In particular, the last component of the abstract set a^,o- (P) maps each nonempty 
Qt C Q to the number of distinct data D which are not the class of i and such that 
the set of all q with {i,q,[l 1-^ D]) G P equals Qf. 

As the first step to defining a big-step successor relation between abstract sets, 
for a G E, ee, uu G {T, ±} and q £ Q, let ((a, ee, uu, q)) be the set of pairs of sets 
of locations that is defined in Figure 9 by recursion over the height of q. (Observe 
that Q'^ — whenever (Q^, QL) G ((o, ee, T, q)).) Those sets satisfy: 

(II) for every data word a over E, state (i, q, v) and set of states P' of A for a, we 
have {i, q, v) P' iff there exists 

{Q'^,QL) e ((<7(i),i + 1 = \a\,v = [l^ [iU,q)) 

such that P' = {{i + l,q',v) : q' G Q'^} U {{i + l,q', [1 ^ : q' G QL}- 
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5(</) 


((a, ee, uu, q)) 




{{a, ee, uu, q')), if a, ee, uu\= P {{a, ee, uu, q")), if a, ee, uu ^ (3 


iiq' 


({a, ee, T, q')) 


q' A q" 


{{Q'^UQ'^,Q'^UQ1} : {Q'^,Q'J G ({a,ee,uu,q'}),(Q'^,Ql} G {(a, ee, uu, q"})} 


q' V q" 


{(a, ee, uu, q')) U {{a, ee, uu, q")) 


T 


{(0,0)} 


± 







{({«'}. 0)}. if ee = ± and uu = ± {(0, {g'})}, if ee = ± and uu = T 

0, if ee = T 




{({9'}. 0)}' if ee = ± and uu = ± {($, {q'})}, if ee = ± and uu = T 

{(0,0)}, if ee = T 



a, ee, uu \= a' ^ a = a' a, ee, uu \= end ® ee = T a, ee, uu |= ti ^ uu = T 

Fig. 9. Defining abstra<;t big-step successors 

The following notations will be useful: given a map / : X — » ViYi) x 'P{Y2), let 
Ui/ = U{^i : {Zi,Z2) G /(X)} U2/ = U{^2 : {ZuZ2} & fiX)} 

For h, h! G iJ^, we write /i => /i' iff /i is of the form (a, ee, Q=,Q$, U) and there exist 

maps g e (5= 1-^ /=((?) G {{a,ee,T ,q)), q € Qi/, ^ h{q) G {{a,ee,±,q)) and q G 
Of fQt,jil) € (('^' -•-> 9)) for each nonempty C Q and j G {1, . . . , tt(<5t)} 
such that: 

—either h' = 0, Ui h = 0, and tt'(gj) = for all Q\, 

— or h' is of the form {a', ee', 0, (J^ /0, ft'), 

^r h' is of the form {a', ee', QL, Ui tt'[<3= ^ tt'(<3'=) - 1]), 

where, for each nonempty Q'^ C Q, 'i'{Q'^) is defined as 



Prom (II), it follows that: 



1, if U2 /= U U2 h U \Jq^j U2 fQfJ = Q\ 
0, otherwise 



(III) for every data word a over E, and unipositional sets P and P' of states of A 

for CT, wc have P P' iff aj\^„{P) => Q!^,o-(P')- 

By (I) and (III), it suffices to compute an incrementing CA Cj^ for wfiich: 

(IV) C^'^ accepts ao ■ . ■ ai-i G S^'^ iff there exists a sequence /iq =^ • • • /i/c-i 
of elements of il^ such that: 

— ho is of the form (ao, ee, 0, {qi}, Qf 0)' 

— for each < i < fc, the first component of hi is Oj; 

— k = I if the second component of hk-i is T. 

is constructed so that it guesses and checks a sequence ho ^ ■ ■ ■ hk-i ^ as 
in (IV), storing at most two consecutive members in any state. To store an abstract 
set (a, ee, Q=, Q0, 11), locations of C^'^ are used for the first four components, and 
)i is stored by means of 2l'3l - 1 counters cg^ for ^ Qt C Q. C^'^ also has 4l'3l 
auxiliary counters cq/^^q^ for Q'^, Q'^ C Q. The nontrivial part of is, given a, 
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for all Q| C Q 
{ while CQ^ > 
{ choose a map q £ i-^ f{q) G ((a, ee, ±, q)); 
<iec(cQ^); inc(cy^ j,y^ } }; 
choose a map q 6 Q= i— » f={q) € ((a, ee,T,g)); 
choose a map g 6 Q0 ^ /0(9) 6 ((«, ee,±,q)); 

Qt ~U2/= u U2/0; 

for all Q'_,,QL C Q 

{ if Cq^ q^ > then Qt := Qj U QL }; 
if Qt 7^ then inc(cQj); 
for all Q'^,QL Q Q 
{ while cg/^ > 

{ dec(cQ^_Q^); if ^ then inc(cQ/^) } } 

ee, <5=) Q0) and tt which is stored by the counters cq^, to guess maps /=, and 
fg^j, and set the counters cq^ so that they store ji' as defined above. Figure 10 
contains pseudo-code for that computation, which is by e transitions. It assumes 
that each cqi_^^qi^ is zero at the beginning, and ensures that the same holds at the 
end. The choices of maps are nondeterministic. If a map cannot be chosen because 
a corresponding set ((a, ee, mm, qfj is empty, the computation blocks. 

Suppose ao...ai-i G S^'^. If there exists a sequence /iq => ■■■hk-i as 
in (IV), the construction of C^" ensures that it accepts . . . aj_i by a run with- 
out incrementing errors. For the reverse direction in (IV), let (a, ee, Q^, Qg, jj) C 
(a', ee', QL, (50, jl') mean that a = a', ee = ee' , Q= C Q'^, C Q'^ and there exists 
an injective 

^■■{{Qhj) : ie{l,...,«(Qt)}}-{(Qt'i') : /G{l,---,mt)}} 
for which C Q'^ whenever i{{Q^,j)) = (Q'pf). Also, let C /i' for all h' e Hj,. 
If C^" accepts gq . . .a;_i (by a run possibly with incrementing errors), we have 
that there exist h^, . . . , G Hj[ such that: 

— ft,Q is of the form (ao, ee, 0, {qi}, Qf 1-^ 0); 

— for each < i < k, the second component of h'^_l is _L, the first component of h'^ 
is ai, and => /ij for some hi ^ h[; 

— h'k-i => 0, and k = I if the second component of is T. 

It remains to observe that C is transitive, and downwards compatible with =>, i.e. 
whenever % ^ hQh' and h' h'^, there exists ft* such that h ^ h^, and /i* Qh'^. 

The computation of follows the same pattern, except that the construction in 
the proof of [Miyano and Hayashi 1984, Theorem 5.1] is used to replace existence 
of winning strategies in two-player weak games by existence of sequences of pairs 
of sets which satisfy a Biichi condition. Specifically, for sets P ^ and P' of states 
of A for a data word a over S, and subsets Pj, of P and of P' which consist only 
of states with odd ranks, we write (P, P\,) ^ (P', P^^) iff there exists a map p Pp 
on P such that p ^ Pp for each p G P, P' = Upep^p. = if ^it ^ and 
= {p' e P' : p(p') is odd} if P^ = 0, where 

P|,' = {p' : for some p G P\,,p' G Pp and p(p') = p{p)} 
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When = for some such map p on P, we say that is fresh. Instead of 

(I) above, we have: 

(V) for every infinite data word a over S, A accepts a iff there exists a sequence 

{Pa,Po.b) ^ {Pi,Pi,\>) =^ • • • of pairs of sets of states of A for a such that 
Pq = {(0, qi, 0)}, Po^b = -Po if p{qi) is odd, Pq^^ = if p{qi) is even, and either 
the sequence ends with (0, 0) or P^ i, is fresh for infinitely many i. 

Finally, we remark that C^" and are computable in polynomial space. The 

pseudo-code in Figure 10 can be implemented so that at most one component of 
the maps q & i-^ f{q) G {{a, ee, ±,q)), q G Q= ^ /=(?) G {{a, ee,T,q)) and 
q & Q% ^ f${q) S ((a, ee, _L,q')) is stored in any state (by means of its location). 
The definition in Figure 9 provides a nondeterministic algorithm which, given a 6 S, 
ee, uu e {T, _L}, q ^ Q and Q'^, QL C Q, checks whether {Q'^,QD G {{a, ee, uu, q)) 
in space polynomial in the size of A. □ 

5. LOWER COMPLEXITY BOUNDS 

To warm up, we show that the upper bounds in Theorem 4.3 are tight already for 
deterministic automata, and in the case of the NLocSPACE-memberships, already 

with no registers. 

Theorem 5.1. The following hold over finite and over infinite data words: 

(a) nonemptiness for IDRA is PSPACE-hard; 

(h) nonemptiness for IDRAq is NLocSPACE-Ziard. 

Proof. Part (b) is an immediate consequence of NLocSPACE-hardness of non- 
emptiness for classical DFA. 

For (a), we reduce from the halting problem for Turing machines with binary 
alphabets and linearly bounded tapes. Precisely, we consider Turing machines 
AA = {Q,qi,S) such that Q is a finite set of locations, qj is the initial location, and 
(5 : Q X {0, 1} ^ Q X {0, 1} X { — 1, 1} is a transition function. A state of is a triple 
{q, i, w) where q € Q is the machine location, < i < is the head position, and 
w e {0, is the tape contents. Let S{q.w{i)) = {q',b,j). If < i + j < \M\, 
the state {q',i+j,w[i h-> 6]) is the unique successor of Otherwise, {q,i,w) 

has no successors. The following problem is PSPACE-hard: given M as above, to 
decide whether the computation from the initial state {qi, 0, 00 ... 0) reaches a state 
with no successor. 

We encode a computation {qo,io,WQ){qi,ii,'Wi) • • • of by the following data 
word over the alphabet Q W {-}. Its underlying word is 

„o 11 1 

--Oq ... "0 "1 • • • "|M|-i • • ■ 

where af — qk if I = ik, and af = - otherwise. There are two equivalence classes: 
7^ 1, 2+ |A^| X /c-l-Z ~ iiwkil) = 0, and 2 + x fc + / ~ 1 if u;fe(/) = 1. 

It is straightforward to construct, in space logarithmic in | | , an automaton Am 
in IDRA with alphabet Q W {-} which accepts a data word iff it has a prefix that 
encodes a computation of M from the initial state to a state with no successor. Am 
has 2 + registers ro, ri, and for < Z < |A^|. It stores [0]^ into ro and [1]^.. 
into ri, and checks that 7^ 1 and the initial state is encoded correctly. Whenever 
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Am moves to a word position 2 + \M\ x {k + 1), it has kept qk and ik using its 
location and has stored [2 + \M\ x fc + Z]^ in r'l for each < Z < \M.\. If {qk, ik, Wk) 
has no successor, Am accepts. Otherwise, it checks that positions 2 + |A^| x + 
...,2+|A11x(A; + 2) — 1 encode the successor state, simultaneously updates rg, 
r'l, . . . , and repeats. □ 

Satisfiability for LTL|;(X,U) and nonemptiness for lARAi were shown in Theo- 
rem 4.4 to be decidable over finite data words, and in IfJ over infinite data words. 
We now establish their non-primitive recursiveness in the finitary case, and 11]'- 
hardness in the infinitary case. In fact, we have those lower bounds even for the 
unary logical fragment and universal automata. 

Theorem 5.2. Satisfiability for LTL{{X,F) and nonemptiness for lURAi are 
not primitive recursive over finite data words, and U^-hard over infinite data words. 

Proof. By Theorem 2.9 (b), it suffices to show that, given an incrementing CA 
C = (E, Q, qi, n, S, F), sentences i/)^" and 0^ of LTL{(X, F) and automata A^'^ and 
Aq in lURAi are computable in logarithmic space, such that their alphabet is 
S = (5 X (S U {s}) X L X Q where L = {inc, dec, if z} x {1, . . . , n}, and 

L«(C) = {a:aG L«(0g)} = {a : a e L"{A^)} 

for a G {<ui,Lj}, where a = wqWi ... if str(cr) = {qo,WQ,lQ,q'Q){qi,Wi,h,q[) ■ ■ ■. 

To ensure that a data word over S encodes a run of C, we constrain its equiv- 
alence relation. Firstly, there must not be two (inc, c) transitions or two (dec, c) 
transitions (with the same c) in the same class. For an (if z, c) transition to be 
correct, whenever it is preceded by (inc, c), there must be an intermediate (dec, c) 
in the same class. Incrementing errors may occur because a (dec, c) transition may 
be preceded by no (inc, c) in the same class. Such a (dec, c) transition corresponds 
to a faulty decrement which leaves c unchanged. It is easy to check that, for every 
run of C, there exists a run which differs at most in counter values and whose only 
incrementing errors are such faulty decrements. 

More precisely, C accepts a finite word w over S iff ui = ct for some finite data word 
a over T, satisfying the following, where str(cr) = (go, wo, lo, <l'o){QitWi,h, q[) ■ ■ ■: 

(1) for each i, {qi, Wi, U, q[) G 5; 

(2) (7o = qi, and for each i > 0, q[_i = qi] 

(3) for the maximum i, q'^ e F; 

(4) there are no c and i < j such that li = Ij = (inc, c) and i j; 

(5) there are no c and i < j such that k = Ij = (dec, c) and i j; 

(6) for all c and i such that li = (inc, c), it is not the case that, there is j > i with 
Ij = (if z, c) but there is no fc > i with Ik = (dec, c) and i k; 

(7) there are no c and i < j < k such that k = (inc, c), Ij = (if z, c), Ik = (dec, c) 
and i '^'^ k. 

(j)^'^ is constructed to express the conjunction of (l)-(7). (l)-(3) are straightfor- 
ward. Among (4)-(7), the most interesting is (7), and the rest can be expressed 
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Fig. 11. Recognising a wrong zero test 



similarly. Observe how (6) and (7) were formulated to avoid using the U operator. 
The following sentence expresses (7): 

-Vc=i f((V5,^,,'('Z, '^S (inc, c),q')) A iiXF((V,,^,,, (<7, (if z, c), g'))A 

XF((Vw<«'^' (<iec,c),g'))ATi)) 

For Aq^ , it is sufficient by Theorem 2.7, for each of (l)-(7), to compute in 
logarithmic space an automaton in INRAi which accepts a finite data word over 
S iff it fails the condition. In fact, (6) and (7) can be treated together by checking 
that some (inc, c) instruction is followed by no occurence of (dec, c) with the same 
datum until (if z, c) occurs, and this automaton is the most interesting. It is shown 
in Figure 11, where {qx,w\,q'i), . . . , {qK, wk^Qk) enumerates Q x (S U {e}) x Q. 

In the infinitary case, we replace (3) by: 

(3') for infinitely many i, qt G F. 

A sentence of LTL{(X, F) which expresses (3') is GF V^gf w ; q'i^' ^'l')- To express 
the negation of (3') in INRAi, the automaton guesses i and checks that qj ^ F for 
each j > i. □ 

From the proofs of Theorems 4.4 and 5.2, and by observing that incrementing 
CA are closed under homomorphisms, we have the following characterisation of 

languages of incrementing CA in terms of languages of future-time LTL with 1 
register. Remarkably, it is not affected by restricting to the unary logical fragment. 

Corollary 5.3. For both a G {kuj^lo} and every finite alphabet S, we have: 

{L"(C) : C is an incrementing CA with alphabet E} 

= {{/(str(a)) e S« : aeL"(0)} : 
S' i S U {s}, (pis a sentence of LTL];(X,F) with alphabet S'} 

= {{/(str(c7)) e S« : a e L-{cf>)} : 
S' ^ S U {s}, (pis a sentence of LTL];(X,U) with alphabet S'} 
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Our final result shows that the problems in Theorem 4.4 become Ej-hard in the 
finitary case and Ej-hard in the infinitary case as soon as any of 1 more register, 
the F"'^ temporal operator or backward automaton moves are added, even after 
restricting to the unary logical fragment and universal automata. The result should 
also be compared with Theorem 4.2. 

The theorem below improves [French 2003, Corollary 1] and [Dcmri ct al. 2007, 
Theorem 3], which showed Sj-hardness of the infinitary satisfiability problems for 
LTL|(X,X-Sf,F-1) and LTL^(X,U). Also, recalling Theorem 2.7, it implies [Neven 
ct al. 2004, Theorem 5.1] where finitary nommivcrsality for INRA was shown un- 
decidable. Undecidability of finitary nonemptiness for 2DRAi was shown in [David 
2004, Section 7.3], using a different encoding. 

Theorem 5.4. Over finite (resp., infinite) data words, we have that satisfiabil- 
ity for LTL{{X,F, F~^), nonemptiness for 2DRAi (resp., 2URAi), satisfiability for 
LrL2(X, F) and nonemptiness for IURA2 are T^^-hard (resp., T\-hard). 

Proof. By Theorem 2.9 (a), it is sufficient to show that, given a Minsky CA 
C = (E, Q, qi, n, S, F), sentences tj)^'^ and 0^ of LTLi(X, F, F^i), automata A^'^ in 
2DRA1 and Ac in 2URAi, sentences Vc'^ and Vc of LTL^(X, F) and automata S^'^ 
and in IURA2 arc computable in logarithmic space, such that their alphabet is 
E = Q X (E U {e}) X L X Q where L = {inc, dec, if z} x {1, . . . , n}, and 

L«(C) = {a : ae L"((/)g)} = {a : a e L"{A^)} 
= {a:ae L"(^^)} ^ {W: a e L"(B^)} 

for a G {<LO,aj}, where a = wqWi ... if str(c7) = (go, w^o, ^o, q'o){Qi,wi,li, q'l) ■■■■ 

To ensure that a data word over E corresponds to a run of C, we constrain its 
equivalence relation as was done for incrementing CA in the proof of Theorem 5.2, 
and in addition require that each (dec,c) transition be preceded by some (inc,c) 
in the same class, which eliminates the possibility of faulty decrements. 

More precisely, C accepts a finite (resp., infinite) word w over E iff w = ct for 
some finite (resp., infinite) data word a over E which satisfies (l)-(7) (resp., (1), 
(2), (3') and (4)- (7)) given in the proof of Theorem 5.2, and 

(8) whenever /j = (dec, c), there exists j < i such that Ij = (inc, c) and i j, 

where str(CT) = (go, wo, lo,q'o){qi,Wi,li,q[} ■ ■ ■. 

To compute (j)^'^ and (/)^, (8) is expressible in LTLi(X, F, F~i) as: 

A:=iG((Vg,«,,g' (9, w, (dec, c), g')) iiF-i((Vg,^,g. (a, w, (inc, c), g')) A Ti)) 
Aq" is constructed to check (l)-(8) as follows: 

— if the current transition, and the previous one (if any), fail (1) or (2), A^" rejects; 

— if the current transition fails (3), »4^" rejects; 

— if the current instruction is (inc, c), Aq'^ stores the current class in the register, 
and then scans ct forwards and rejects if it finds an (inc, c) in the same class, or 
an (ifz, c) before a (dec,c) in the same class, but otherwise returns; 
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— if the current instruction is (dec, c), A^^ stores the current class in the register, 
and then scans a backwards and rejects if it finds a (dec, c) in the same class, or 

no (inc, c) in the same class, but otherwise returns; 
— if there is a next transition, A'^'^ repeats the above for it, but otherwise accepts. 

Aq is constructed by extending the construction of in the proof of Theorem 5.2 
by expressing the negation of (8) by an automaton in 2NRAi: it guesses a position 
with a (dec, c) instruction, and checks that it is not preceded by an (inc, c) in the 
same class. 

For the logical fragments and automata classes with 2 registers, we use a different 
encoding of runs of C by data words, similar to the modelling in [Lisitsa and Potapov 
2005, Section 4] of Minsky machines by systems of pebbles. Let S = SU ({hi, lo} x 

{1, . . . , n}). For a data word a over T,, let a — a \ S. 

Each transition {q,w,l,q') in a run of C is encoded by a block whose sequence 
of letters is (hi, l)(lo, 1) • • • {hi, n) {lo, n) {q, w, I , q') . For each counter c, two oc- 
curences of (hi, c) are in the same class iff there is no occurence of (inc, c) between 
them, which gives a sequence of classes Dq, Di, ... Each occurence of (lo, c) is in 
some class Di. If prior to a transition of C, a counter c has value m, that is encoded 
by occurences of (lo, c) and (hi, c) in the corresponding block being in some classes 
Di and A+m- 

More precisely, wc have that C accepts a finite (resp., infinite) word w over S iff 
w = a for some finite (resp., infinite) data word a over S which satisfies: 

(i) str(cr) is a sequence of blocks (hi, l)(lo, 1) • • • (hi, n)(lo, n)(g', w, Z, g'); 

(ii) each {q, w, I, q') is in 5; 

(in) for the first {q,w,l,q'), q = qj, and for each {q,w,l,q') and {q" , w' , I' , q'") 
which are consecutive, q' = q"; 

(iv) for the last {q, w, I, q'), q' & F (resp., infinitely often q e F); 

(v) in the inital block, for each c, (hi, c) and (lo, c) are in the same class; 

(vi) in each block immediately after an (inc, c) one, (hi, c) is not in the same class 
as any preceding (hi, c), and (lo, c) is in the same class as the previous (lo, c); 

(vii) in each (dec, c) block, (hi, c) and (lo, c) are not in the same class; 

(viii) in each block immediately after a (dec, c) block B, (hi, c) is in the same class 
as the previous (hi,c), and (lo,c) is in the same class as (hi,c) in the block 
immediately after the last block containing (hi, c) which is in the same class as 
(lo, c) in B; 

(ix) in each (if z, c) block, (hi,c) and (lo,c) are in the same class. 

For ip^'^ and i/j^, each of (i) (ix) is expressed in LTL2(X,F). In fact, (viii) natu- 
rally splits into two halves, and the second half is the most involved among (i)-(ix): 

ga:=i ((hi,c>^iix2»+i(^ti^ 

i2G((lo,c> A Ti A (x2("-^)+Wg,^,g'<9.w;, (dec,c),g')) ^^^+'h)) 

It remains by Theorem 2.7, for each of (i)-(ix), to compute in logarithmic space 
an automaton in INRA2 which accepts a finite (resp., infinite) data word a over 
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Fig. 12. Complexity of satisfiability for fragments of LTL with the freeze quantifier 

S iff it fails the condition. For the second half of (viii), which is again the most 
involved, the automaton guesses a position with a (hi,c) letter, checks that the 
position 2n + 1 steps forwards (which is the next occurence of (hi, c)) is not in the 
same class, guesses a subsequent position with the (lo, c) letter which is in the same 
class as the first (hi, c) position and whose block ends with the (dec, c) instruction, 
and checks that the position 2n + 1 steps forwars (which is the next occurence of 
(lo,c)) is not in the same class as the second (hi,c) position. □ 

6. CONCLUSION 

By Theorems 4.2, 4.4, 5.2 and 5.4, we have the results on complexity of satisfiability 
shown in Figure 12, where 'R, not PR' means decidable and not primitive recursive. 
The entries not in bold follow from [French 2003, Corollary 1] and [Demri et al. 
2007, Theorem 3]. 

The results on complexity of nonemptiness for register automata in Sections 4 
and 5, except E^-membership of infinitary nonemptiness for 2NRA, are depicted in 
Figure 13. The edges indicate the syntactic inclusions between automata classes. 
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